diff --git a/valkey-operator/CHANGELOG.md b/valkey-operator/CHANGELOG.md
index f5d0d40..6cdbc4c 100644
--- a/valkey-operator/CHANGELOG.md
+++ b/valkey-operator/CHANGELOG.md
@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.4.2
+
+### Fixed
+
+- Align ServiceMonitor endpoint port name and scrape scheme with `metrics.secure`.
+  When secure metrics are enabled the metrics Service exposes port `https`, but
+  the ServiceMonitor previously always targeted port `http`, so scrapes failed.
+  Defaults `scheme: https` when `metrics.secure` is true and
+  `serviceMonitor.scheme` is unset.
+
+### Added
+
+- `metrics.serviceMonitor.insecureSkipVerify` (default `false`). When true and
+  `metrics.secure` is true and `serviceMonitor.tlsConfig` is empty, injects
+  `tlsConfig.insecureSkipVerify` for the operator's self-signed metrics cert.
+  Explicit `serviceMonitor.tlsConfig` always wins.
+
 ## 0.4.1
 
 ### Changed
diff --git a/valkey-operator/Chart.yaml b/valkey-operator/Chart.yaml
index cbebbdd..6b72ee6 100644
--- a/valkey-operator/Chart.yaml
+++ b/valkey-operator/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: valkey-operator
 description: A Helm chart for the Valkey Operator
 type: application
-version: 0.4.1
+version: 0.4.2
 appVersion: "v0.4.0"
 kubeVersion: ">=1.20.0-0"
 home: https://valkey.io/valkey-helm/
diff --git a/valkey-operator/README.md b/valkey-operator/README.md
index 86233fd..cfa6a7f 100644
--- a/valkey-operator/README.md
+++ b/valkey-operator/README.md
@@ -1,6 +1,6 @@
 # valkey-operator
 
-![Version: 0.4.0](https://img.shields.io/badge/Version-0.4.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.4.0](https://img.shields.io/badge/AppVersion-v0.4.0-informational?style=flat-square)
+![Version: 0.4.2](https://img.shields.io/badge/Version-0.4.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.4.0](https://img.shields.io/badge/AppVersion-v0.4.0-informational?style=flat-square)
 
 A Helm chart for deploying the [Valkey Operator](https://github.com/valkey-io/valkey-operator) on Kubernetes.
 
@@ -73,8 +73,9 @@ See [values.yaml](values.yaml) for the full list of configurable parameters.
 | `metrics.serviceMonitor.annotations` | Annotations for the ServiceMonitor | `{}` |
 | `metrics.serviceMonitor.interval` | Scrape interval | `""` |
 | `metrics.serviceMonitor.scrapeTimeout` | Scrape timeout | `""` |
-| `metrics.serviceMonitor.scheme` | HTTP scheme used for scraping | `""` |
-| `metrics.serviceMonitor.tlsConfig` | TLS configuration used when scraping | `{}` |
+| `metrics.serviceMonitor.scheme` | Scrape scheme. Empty: `https` when `metrics.secure` is true, else Prometheus default (`http`) | `""` |
+| `metrics.serviceMonitor.insecureSkipVerify` | When `metrics.secure` is true and `tlsConfig` is empty, set `tlsConfig.insecureSkipVerify` for the self-signed metrics cert (opt-in) | `false` |
+| `metrics.serviceMonitor.tlsConfig` | Full scrape TLS config; when set, overrides `insecureSkipVerify` | `{}` |
 | `metrics.serviceMonitor.honorLabels` | Keep labels from the scraped target on collision | `false` |
 | `metrics.serviceMonitor.relabelings` | relabelings applied before scraping | `[]` |
 | `metrics.serviceMonitor.metricRelabelings` | metricRelabelings applied before ingestion | `[]` |
@@ -170,6 +171,54 @@ metrics:
 Both `metrics.secure` and `metrics.reader.binding.create` default to `false`, so existing
 installs keep serving metrics over insecure HTTP unless you opt in.
 
+### ServiceMonitor
+
+Set `metrics.serviceMonitor.enabled: true` to create a Prometheus Operator ServiceMonitor
+for the operator metrics Service. The endpoint **port name** always matches the metrics
+Service: `http` when `metrics.secure` is `false`, `https` when it is `true`.
+
+When `metrics.secure` is `true`:
+
+- If `serviceMonitor.scheme` is empty, the chart sets `scheme: https`.
+- The operator's metrics cert is self-signed by default. Scrapes will fail TLS
+  verification until you either:
+  - set `serviceMonitor.insecureSkipVerify: true` (opt-in; injects
+    `tlsConfig.insecureSkipVerify`), or
+  - set `serviceMonitor.tlsConfig` yourself (e.g. a CA). Explicit `tlsConfig` wins
+    over `insecureSkipVerify`.
+
+Example with secure metrics and a ServiceMonitor that accepts the self-signed cert:
+
+```yaml
+metrics:
+  secure: true
+  reader:
+    binding:
+      create: true
+      serviceAccountName: prometheus
+      namespace: monitoring
+  serviceMonitor:
+    enabled: true
+    labels:
+      # match your Prometheus serviceMonitorSelector
+      release: prometheus
+    insecureSkipVerify: true
+```
+
+Example with a custom CA instead of skip-verify:
+
+```yaml
+metrics:
+  secure: true
+  serviceMonitor:
+    enabled: true
+    tlsConfig:
+      ca:
+        secret:
+          name: operator-metrics-ca
+          key: ca.crt
+```
+
 ## Source Code
 
 * <https://github.com/valkey-io/valkey-operator>
diff --git a/valkey-operator/templates/servicemonitor.yaml b/valkey-operator/templates/servicemonitor.yaml
index b08691b..2d481e2 100644
--- a/valkey-operator/templates/servicemonitor.yaml
+++ b/valkey-operator/templates/servicemonitor.yaml
@@ -15,7 +15,8 @@ metadata:
   {{- end }}
 spec:
   endpoints:
-  - port: http
+  # Port name must match metrics-service.yaml (http when insecure, https when metrics.secure).
+  - port: {{ if .Values.metrics.secure }}https{{ else }}http{{ end }}
     honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }}
     {{- with .Values.metrics.serviceMonitor.interval }}
     interval: {{ . }}
@@ -23,12 +24,18 @@ spec:
     {{- with .Values.metrics.serviceMonitor.scrapeTimeout }}
     scrapeTimeout: {{ . }}
     {{- end }}
-    {{- with .Values.metrics.serviceMonitor.scheme }}
-    scheme: {{ . }}
+    {{- if .Values.metrics.serviceMonitor.scheme }}
+    scheme: {{ .Values.metrics.serviceMonitor.scheme }}
+    {{- else if .Values.metrics.secure }}
+    scheme: https
     {{- end }}
-    {{- with .Values.metrics.serviceMonitor.tlsConfig }}
+    {{- if .Values.metrics.serviceMonitor.tlsConfig }}
     tlsConfig:
-      {{- toYaml . | nindent 6 }}
+      {{- toYaml .Values.metrics.serviceMonitor.tlsConfig | nindent 6 }}
+    {{- else if and .Values.metrics.secure .Values.metrics.serviceMonitor.insecureSkipVerify }}
+    # Opt-in: operator metrics use a self-signed cert by default.
+    tlsConfig:
+      insecureSkipVerify: true
     {{- end }}
     {{- with .Values.metrics.serviceMonitor.relabelings }}
     relabelings:
diff --git a/valkey-operator/values.yaml b/valkey-operator/values.yaml
index ecb3be4..084631e 100644
--- a/valkey-operator/values.yaml
+++ b/valkey-operator/values.yaml
@@ -235,9 +235,15 @@ metrics:
     interval: ""
     # Scrape timeout (defaults to the Prometheus global timeout when empty)
     scrapeTimeout: ""
-    # HTTP scheme used for scraping (defaults to http when empty)
+    # HTTP scheme used for scraping. When empty: https if metrics.secure is true,
+    # otherwise Prometheus defaults to http.
     scheme: ""
-    # TLS configuration used when scraping the endpoint
+    # When metrics.secure is true and tlsConfig is empty, set
+    # tlsConfig.insecureSkipVerify so scrapers accept the operator's self-signed
+    # metrics cert. Defaults to false (opt-in). Ignored when tlsConfig is set.
+    insecureSkipVerify: false
+    # Full TLS configuration for the scrape endpoint. When set, wins over
+    # insecureSkipVerify. Use this to trust a real CA instead of skip-verify.
     tlsConfig: {}
     # Keep labels from the scraped target on collision with server-side labels
     honorLabels: false